diff --git a/server/objectives/mutations.py b/server/objectives/mutations.py index df9e50ff..ca615e21 100644 --- a/server/objectives/mutations.py +++ b/server/objectives/mutations.py @@ -1,6 +1,7 @@ import graphene from graphene import relay, InputObjectType from graphql_relay import from_global_id +from rest_framework.exceptions import PermissionDenied from api.utils import get_object from books.models import Module @@ -67,13 +68,18 @@ class AddObjectiveGroup(relay.ClientIDMutation): @classmethod def mutate_and_get_payload(cls, root, info, **kwargs): + + owner = info.context.user + if not owner.has_perm('users.can_manage_school_class_content'): + raise PermissionDenied('Missing permissions') + objective_group_data = kwargs.get('objective_group') title = objective_group_data.get('title') if title != 'society': title = 'language_communication' module_id = objective_group_data.get('module') module = get_object(Module, module_id) - owner = info.context.user + new_objective_group = ObjectiveGroup.objects.create(title=title, module=module, owner=owner) objectives = objective_group_data.get('objectives') for objective in objectives: @@ -89,9 +95,15 @@ class UpdateObjectiveGroup(relay.ClientIDMutation): @classmethod def mutate_and_get_payload(cls, root, info, **kwargs): + + user = info.context.user + if not user.has_perm('users.can_manage_school_class_content'): + raise PermissionDenied('Missing permissions') + objective_group_data = kwargs.get('objective_group') id = objective_group_data.get('id') objective_group = get_object(ObjectiveGroup, id) + objectives = objective_group_data.get('objectives') existing_objective_ids = list(objective_group.objectives.values_list('id', flat=True)) for objective in objectives: diff --git a/server/objectives/tests.py b/server/objectives/tests.py deleted file mode 100644 index a39b155a..00000000 --- a/server/objectives/tests.py +++ /dev/null @@ -1 +0,0 @@ -# Create your tests here. diff --git a/server/objectives/tests/__init__.py b/server/objectives/tests/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/server/rooms/tests/test_room_query_permission.py b/server/rooms/tests/test_room_query_permission.py index 449f03f0..6a2cc583 100644 --- a/server/rooms/tests/test_room_query_permission.py +++ b/server/rooms/tests/test_room_query_permission.py @@ -1,11 +1,9 @@ from django.test import TestCase, RequestFactory from graphene.test import Client -from graphql_relay import to_global_id from api.schema import schema from core.factories import UserFactory from rooms.factories import RoomFactory, RoomEntryFactory -from rooms.models import Room from users.factories import SchoolClassFactory